Part A review
Frequency depends on the nature, size and complexity of the business and its risk profile. Reviewers must be independent and cannot have participated in program design or ongoing management.
Part B review
Covers customer identification and verification — and may examine secondary policies (onboarding manuals, application forms, related procedures) to identify inconsistencies.